[PATCH 6/8] Added CCEs to remaining XCCDF rules
Shawn Wells
shawn at redhat.com
Sat Oct 26 03:28:34 UTC 2013
-------------- next part --------------
>From b270790a27858efcd198d7099c2acc52796b34d8 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 25 Oct 2013 23:21:04 -0400
Subject: [PATCH 6/8] Added CCEs to remaining XCCDF rules
- All rules now have CCE values
---
RHEL6/input/services/snmp.xml | 2 ++
RHEL6/input/system/accounts/physical.xml | 2 ++
.../accounts/restrictions/account_expiration.xml | 1 +
.../accounts/restrictions/password_storage.xml | 1 +
RHEL6/input/system/auditing.xml | 2 ++
RHEL6/input/system/permissions/files.xml | 5 ++++-
RHEL6/input/system/software/disk_partitioning.xml | 1 +
RHEL6/input/system/software/integrity.xml | 2 ++
RHEL6/input/system/software/updating.xml | 1 +
9 files changed, 16 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/services/snmp.xml b/RHEL6/input/services/snmp.xml
index ec22a42..0e4f8b3 100644
--- a/RHEL6/input/services/snmp.xml
+++ b/RHEL6/input/services/snmp.xml
@@ -83,6 +83,7 @@ There should be no output.
Earlier versions of SNMP are considered insecure, as they potentially allow
unauthorized access to detailed system management information.
</rationale>
+<ident cce="27365-6"/>
</Rule>
<Rule id="snmpd_not_default_password" severity="medium">
@@ -101,6 +102,7 @@ There should be no output.
Presence of the default SNMP password enables querying of different system
aspects and could result in unauthorized knowledge of the system.
</rationale>
+<ident cce="27593-3"/>
<tested by="MAN" on="20121214"/>
</Rule>
diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml
index 1631797..ead411a 100644
--- a/RHEL6/input/system/accounts/physical.xml
+++ b/RHEL6/input/system/accounts/physical.xml
@@ -166,6 +166,7 @@ In the GNOME graphical environment, risk of unintentional reboot from the
Ctrl-Alt-Del sequence is reduced because the user will be
prompted before any action is taken.
</rationale>
+<ident cce="27567-7"/>
</Rule>
<Rule id="disable_interactive_boot" severity="medium">
@@ -417,6 +418,7 @@ smart card (CAC) authentication:
that provided by a username/password combination. Smart cards leverage a PKI
(public key infrastructure) in order to provide and verify credentials.
</rationale>
+<ident cce="27440-7"/>
<ref disa="765,766,767,768,771,772,884" />
</Rule>
diff --git a/RHEL6/input/system/accounts/restrictions/account_expiration.xml b/RHEL6/input/system/accounts/restrictions/account_expiration.xml
index 0d92037..58e9191 100644
--- a/RHEL6/input/system/accounts/restrictions/account_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/account_expiration.xml
@@ -102,6 +102,7 @@ remain in place and active after the need for them no longer exists. Account
expiration greatly reduces the risk of accounts being misused or hijacked.
<br/>
</rationale>
+<ident cce="27474-6"/>
<ref nist="AC-2(2),AC-2(3)" disa="16,1682"/>
</Rule>
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
index fb2efc0..9720505 100644
--- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
@@ -82,6 +82,7 @@ There should be no output.
<rationale>
Inconsistency in GIDs between <tt>/etc/passwd</tt> and <tt>/etc/group</tt> could lead to a user having unintended rights.
</rationale>
+<ident cce="27379-7"/>
<ref disa="366" />
<tested by="DS" on="20121024"/>
</Rule>
diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index 16585ba..e1bd4dc 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -245,6 +245,7 @@ determine how many logs the system is configured to retain after rotation:
<rationale>The total storage for audit log files must be large enough to retain
log information over the period required. This is a function of the maximum log
file size and the number of logs retained.</rationale>
+<ident cce="27522-2"/>
<oval id="auditd_data_retention_num_logs" value="var_auditd_num_logs" />
<ref nist="AU-1(b),AU-11,IR-5" />
<tested by="DS" on="20121024"/>
@@ -269,6 +270,7 @@ determine how much data the system will retain in each audit log file:
<rationale>The total storage for audit log files must be large enough to retain
log information over the period required. This is a function of the maximum
log file size and the number of logs retained.</rationale>
+<ident cce="27550-3"/>
<oval id="auditd_data_retention_max_log_file" value="var_auditd_max_log_file" />
<ref nist="AU-1(b),AU-11,IR-5" />
<tested by="DS" on="20121024"/>
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index 7d4add9..16b7618 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -214,6 +214,7 @@ run the following command for each directory <i>DIR</i> which contains shared li
space of processes (including privileged ones) or of the kernel itself at
runtime. Restrictive permissions are necessary to protect the integrity of the system.
</rationale>
+<ident cce="27381-3"/>
<ref nist="AC-6" disa="1499"/>
<tested by="DS" on="20121026"/>
<oval id="file_permissions_library_dirs" />
@@ -252,6 +253,7 @@ owned by root:
space of processes (including privileged ones) or of the kernel itself at
runtime. Proper ownership is necessary to protect the integrity of the system.
</rationale>
+<ident cce="27424-1"/>
<ref nist="AC-6" disa="1499"/>
<oval id="file_ownership_library_dirs" />
<tested by="swells" on="20130914"/>
@@ -290,6 +292,7 @@ run the following command for each directory <i>DIR</i> which contains system ex
and restrictive permissions are necessary to ensure execution of these programs
cannot be co-opted.
</rationale>
+<ident cce="27289-8"/>
<ref nist="AC-6" disa="1499"/>
<oval id="file_permissions_binary_dirs" />
</Rule>
@@ -326,10 +329,10 @@ run the following command for each directory <i>DIR</i> which contains system ex
and restrictive permissions are necessary to ensure that their
execution of these programs cannot be co-opted.
</rationale>
+<ident cce="27623-8"/>
<ref nist="AC-6" disa="1499"/>
</Rule>
-
</Group>
<Rule id="sticky_world_writable_dirs">
diff --git a/RHEL6/input/system/software/disk_partitioning.xml b/RHEL6/input/system/software/disk_partitioning.xml
index a94943b..54b45ae 100644
--- a/RHEL6/input/system/software/disk_partitioning.xml
+++ b/RHEL6/input/system/software/disk_partitioning.xml
@@ -158,6 +158,7 @@ The risk of a system's physical compromise, particularly mobile systems such as
laptops, places its data at risk of compromise. Encrypting this data mitigates
the risk of its loss if the system is lost.
</rationale>
+<ident cce="27596-6"/>
<ref nist="SC-13, SC-28" disa="1019,1199,1200" />
</Rule>
diff --git a/RHEL6/input/system/software/integrity.xml b/RHEL6/input/system/software/integrity.xml
index b706f90..c7879ae 100644
--- a/RHEL6/input/system/software/integrity.xml
+++ b/RHEL6/input/system/software/integrity.xml
@@ -200,6 +200,7 @@ McAfee HBSS, which is available through Cybercom.
Host-based intrusion detection tools provide a system-level defense when an
intruder gains access to a system or network.
</rationale>
+<ident cce="27409-2"/>
<ref nist="SC-7" disa="1263"/>
</Rule>
@@ -239,6 +240,7 @@ To check on the age of uvscan virus definition files, run the following command:
Virus scanning software can be used to detect if a system has been compromised by
computer viruses, as well as to limit their spread to other systems.
</rationale>
+<ident cce="27529-7"/>
<ref nist="SC-28, SI-3" disa="1239,1668"/>
</Rule>
diff --git a/RHEL6/input/system/software/updating.xml b/RHEL6/input/system/software/updating.xml
index cccf5c2..aef22ec 100644
--- a/RHEL6/input/system/software/updating.xml
+++ b/RHEL6/input/system/software/updating.xml
@@ -123,6 +123,7 @@ to determine if the system is missing applicable updates.
Installing software updates is a fundamental mitigation against
the exploitation of publicly-known vulnerabilities.
</rationale>
+<ident cce="27635-2"/>
<ref nist="SI-2,MA-1(b)" disa="1227,1233"/>
<tested by="MM" on="20120928"/>
</Rule>
--
1.7.1
More information about the scap-security-guide
mailing list